EUVD-2026-44470
GHSA-3wc9-fv9q-6v3m
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OpenAI-compatible inference API is network-facing by design; AV:N and PR:N reflect unauthenticated network access, with availability-only impact.
Primary rating from Vendor (nvidia).
CVSS VectorVendor: nvidia
Lifecycle Timeline
1DescriptionCVE.org
NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits or throttling. A successful exploit of this vulnerability might lead to denial of service.
AnalysisAI
Unbounded GPU resource allocation in NVIDIA TensorRT-LLM's OpenAI-compatible inference API allows an attacker to exhaust GPU resources on the host system, resulting in denial of service. Affected versions span all releases up to and including v1.3.0 rc14. No public exploit or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none and technical impact as partial, consistent with a localized availability-only impact.
Technical ContextAI
NVIDIA TensorRT-LLM (cpe:2.3:a:nvidia:tensorrt-llm:*:*:*:*:*:*:*:*) is a high-performance LLM inference optimization library that exposes an OpenAI-compatible HTTP API for serving large language models on NVIDIA GPU hardware. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the inference API does not enforce quotas, caps, or rate limits on GPU memory or compute resource allocation per request or per client. A caller can submit requests that drive unbounded GPU allocations, starving other workloads or crashing the inference server. The official CVSS vector records AV:L, suggesting the API may be treated as a locally-scoped service, though OpenAI-compatible APIs are architecturally network-facing; see confidence notes.
RemediationAI
Upgrade NVIDIA TensorRT-LLM to a version beyond v1.3.0 rc14; the exact patched release version was not independently confirmed from the available references - consult the NVIDIA security bulletin and TensorRT-LLM release notes directly for a confirmed fix version. If upgrading is not immediately possible, apply compensating controls at the API layer: configure an API gateway or reverse proxy (e.g., nginx) in front of the inference endpoint with per-client and global request rate limits and concurrency caps to restrict unbounded resource allocation. Additionally, restrict network access to the inference API to trusted internal IP ranges only, reducing the attacker population. Note that rate limiting at the proxy layer does not eliminate the root CWE-770 flaw but significantly raises the effort required for exploitation. Monitor GPU memory utilization and set alerting thresholds to detect anomalous allocation patterns early.
More in Tensorrt Llm
View allDeserialization of untrusted data in NVIDIA TensorRT-LLM across all platforms allows a local, low-privileged attacker to
Unsafe deserialization in NVIDIA TensorRT-LLM's RPC testing component allows a local high-privileged attacker to trigger
Unsafe deserialization in NVIDIA TensorRT-LLM's MPI server component allows a high-privileged local attacker to achieve
Insecure deserialization in NVIDIA TensorRT-LLM for Linux lets a local, low-privileged attacker abuse a weakness in the
Local privilege-context deserialization in NVIDIA TensorRT-LLM lets an attacker who already has same-user access to a ho
Heap-based buffer overflow in NVIDIA TensorRT-LLM's tensor deserialization path lets an adjacent, unauthenticated attack
Null pointer dereference in NVIDIA TensorRT-LLM across all supported platforms allows a local attacker to crash the appl
Memory corruption in NVIDIA TensorRT-LLM allows an attacker with local access to trigger a write-what-where primitive (C
Missing authentication in NVIDIA TensorRT-LLM for Linux lets an attacker reach the disaggregated orchestrator's FastAPI
Server-side request forgery in NVIDIA TensorRT-LLM for Linux exposes AI inference servers to internal network pivoting v
Unsafe deserialization in NVIDIA TensorRT-LLM's visual gen server through version 1.3.0 rc11 allows a locally privileged
Missing authentication for a critical function in NVIDIA TensorRT-LLM for Linux (all versions through v1.3.0 rc12) allow
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today